Hot liquid metal (sodium) flows on the shell side of a typical LMFBR steam generator, and high-pressure water/steam flows through the internal tube bundle in counterflow to the sodium. When the barrier between the sodium and water circuits is defective, a localized sodium-water reaction occurs at the site of the defect. The sodium and water reaction and growth of the reaction product (hydrogen gas) bubbles produces a localized noise source within the vessel. The leak site is stationary or fixed in space. The random acoustic pressures generated by the sodium-water reaction can be monitored to assess whether a leak exists at a given location within the vessel, and if it exists, to predict the magnitude and damage potential of the leak.
Operational experience with LMFBR power plants has shown the steam generator to be the prime component having potential to reduce plant availability. Data from sodium-water reaction damage investigations show any through-wall hole in a steam generator heat transfer tube can cause severe damage to the unit, unless corrective action is taken to prevent damage propagation. As shown in FIG. 1, experimental evidence indicates this corrective action must be taken within 40 sec from initiation of an intermediate-sized leak. This timescale is too short for effective operator intervention. Such a requirement can only be satisfied by an automatic shutdown system for the steam generator activated by suitable leak detection systems.
The advanced liquid metal reactor (ALMR) includes liquid sodium-heated, helical coil steam generators 2 (see FIG. 2) producing superheated steam to drive the turbines 4. The steam generator is designed to be convectively cooled by blowing cold air between the steam generator shell 6 and the outer shroud 8. A reaction product separation tank 10 and hydrogen vent system 12 protect the secondary heat transfer system in the event of a sodium-water reaction in the steam generator. The vessel is designed with rupture disks 14 that drain the sodium from the steam generator into tank 10, thereby protecting against damage to the intermediate loop and the reactor.
A sodium-water reaction in the steam generator results from failure of the barrier between the sodium and steam/water circuits. Failures can range from a microscopically small defect in a single tube injecting less than about 1 gm/sec of water (small leak), to a relatively large hole in a single tube injecting about 100 gm/sec of water (intermediate leak), or to complete failure of one or more heat transfer tubes so that the injection rate can reach thousands of gm/sec for a short period of time (large leak). Water/steam injection can also result from failure of the tube sheet, again with the potential for a wide range of injection rates.
Reference designs for the ALMR secondary heat transfer system, and specifically for the steam generator, include features to accommodate sodium-water reactions and reduce any potential for damage propagation to other parts of the reactor system to a negligible level. The normal progression of an intermediate or large sodium-water reaction event in a steam generator will cause a rise in steam generator pressure from the normal level. A burst tube can cause failure of the rupture disk 14 (see FIG. 2) within about 10 .mu.sec; smaller leaks cause a gradual over-pressurization and disk failure at 2 MPa. Over-pressurization of the unit causes failure of the rupture disks located at the base of the unit, and activation of the steam/water isolation and blowdown system. The steam generator protection system will isolate and blow down the water side within 30 seconds of the rupture disk failure, and reaction products are passively vented through the failed disk. The reaction products are gravity drained into a specially designed reaction product collection tank, and gaseous hydrogen is burned to form steam before release to the atmosphere. The secondary loop has very low levels of reactivity so there is insignificant reactivity release beyond the plant boundary.
Water seepage through a defect in the heat transfer tube of a sodium heated steam generator causes self-enlargement of the original fissure. The damage initially takes the form of a crater on the sodium side connected to the water side by the original fissure. While the crater is deepening, the water/steam injection through the fissure is limited by choked flow, and is a function of the original fissure minimum area. This phenomenon is referred to as "self-wastage". When the crater finally deepens and breaks through to the water side of the tube, the injection rate escalates orders of magnitude, into a leak rate classified as an "intermediate" regime. If the original defect is sufficiently large in size (a few mils), a free-standing jet of water/steam (fractional to a few grams per second) is injected into the sodium. The small leak jet reacts to produce high-temperature, extremely corrosive reaction products which impinge onto adjacent tubes. These products cause wastage of the tube and eventually failure of the tube. The resultant water injection rate is generally in the intermediate regime (10 gm/sec to 1 kg/sec of water/steam). Escalation can occur within a few (&gt;3) seconds. Further escalation of damage due to wastage, or from tube overheating and bursting, results in injection rates in excess of hundreds of grams per second, classified as "large" regime. Escalation time scales are again of the order of a few tens of seconds.
Both microleaks and small leaks propagate into intermediate-sized leaks, the microleak without warning and the small leak with an ambiguous indication at best. Test and operating plant incidents showed intermediate leaks cause maximum damage to a steam generator system. A systematic series of tests also showed that the acoustic signal from such leaks could be reliably detected, and automatic corrective actions taken in time to prevent any further damage propagation. Chemical detection may provide similar protection at high sodium flow rates, but if the transit time from the leak site to the detector is greater than 30 seconds, it becomes ineffective for intermediate leak protection. Many operating conditions result in transit times greater than this, and so the chemical detection system will have limited coverage.
Water/steam injection through the fissure is not always constant, and for significant periods of time, a microleak may remain plugged. The intermittent character of the injection and the long time scales associated with microleak phenomena reduce the reliability of leak detection prior to leak escalation. The actual time taken for the leak to transition from slow water seepage to an intermediate leak is an important parameter in designing water-into-sodium leak detection and protection systems. If the escalation time is of the order of 20 minutes or longer, the reactor operator can take corrective action to prevent damage propagation. If the time scale is less than about 2 minutes, the operator cannot react quickly enough and an automatic protection system is required. Such systems require confirming evidence that a leak is present, to reduce the possibility of false alarms and reduced plant availability. One candidate for the automatic protection system is chemical monitoring for reaction products. The transit time from a leak site to the chemical monitor at full power is of the order of minutes. The demonstrated escalation time of a few seconds indicates the utility of chemical monitors, even at full sodium flow conditions, is questionable for protection against escalating damage.
When the injection rate of water/steam into sodium is very low, i.e., microleaks up to about 0.01 gm/sec, any leak detection system is ineffective. The hydrogen released by the reaction or the acoustic noise of the reaction is so small that it is masked by normal background fluctuations in the parameters. Initial defect sizes are below a practical limit for detection/location by non-destructive examination (NDE) techniques.
It is essential that the power plant operator and steam generator designer have sufficient knowledge of wastage phenomena, and its consequences, to judge the action required from the behavior of leak detection monitors. The extreme sensitivity of detection systems increases the potential for false alarms and reduced plant availability. Alarm levels must be set to provide protection while minimizing detection errors. If the level is set too high, then damage propagation to large leak conditions will occur. If the level is set too low, then spurious power plant shutdowns will reduce availability, and ultimately plant reliability, since each rapid shutdown exposes equipment to thermal and mechanical transients and shocks.
The majority of leak detection systems designed and incorporated into currently operating steam generator systems have attempted to detect the smallest possible leak. Corrective action is usually initiated by warning the plant operator when an anomalous signal is present. Some form of automatic shutdown of the steam generator might be initiated for extremely high signal levels, but the threshold is usually set so high that a rupture disk burst is likely to occur first.
The sodium-water reaction produces a broadband signal, with maximum power and amplitudes in the acoustic range (up to 20 kHz), and signals detectable at ultrasonic frequencies (80 to 500 kHz). The background noise has similar characteristics, peaking in the audio range and falling off in power and amplitude as f.sup.n (n having values of -2 to -3, and increasing with frequency). Past acoustic leak detection programs demonstrated the capacity to both detect and locate noise sources, and to detect signals totally masked by background noise. Past ultrasonic leak detection programs relied upon a positive signal-to-noise ratio being present in the chosen detection frequency band.